[cao-evolution:compiler-security] Compiler and security scan findings: githubnext/gh-aw-cao (74 lint issues, 52 High zizmor, license/CVE policy failures)

Compiler run for `githubnext/gh-aw-cao` (53 workflow sources, 53 lock files) exited with code **1**. actionlint found 74 issues (72 shellcheck, 2 expression errors); zizmor flagged 52 High "dangerous GitHub App token" findings plus 444 Medium `secrets-outside-env` and 33 Medium `artipacked` findings across all 42 compiled workflows; grype found 34 Critical / 172 High / 312 Medium CVEs across the 9 pinned container images (mostly OpenSSL/libcrypto in `alpine:latest` and `node:lts-alpine`, plus npm packages `brace-expansion`, `tar`, `ip-address`); `grant` failed strict-mode license-policy checks with **1246 findings** (GPL-2.0/LGPL/MPL packages in base images not covered by the current allowlist). Poutine and runner-guard reported 1 informational finding on an untracked file; yamllint was clean. Highest-severity supported finding: grype **Critical** CVEs (e.g. CVE-2026-63073, CVE-2026-75803 in `libssl3`/`libcrypto3`).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (shellcheck) | 18 lock files (e.g. `uk-ai-advisory.lock.yml`, `eu-cra-compliance.lock.yml`) | unknown | SC1003: unescaped single quote in "Execute Pi CLI" embedded script (`echo 'This is how it'\''s done'`) | Fix quoting in the shared Pi CLI install/example script template, recompile |
| actionlint (expression) | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` not defined on referenced step-outputs object | Correct the expression/step id reference in the workflow source, recompile |
| zizmor | 42 compiled workflows | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token` conditioned on optional secrets) | Review App token scoping/condition per zizmor guidance; add justification or restrict token permissions |
| zizmor | 42 compiled workflows (444 occurrences) | Medium | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Move secret-consuming steps into an `environment:` block or add zizmor ignore with rationale |
| zizmor | 33 occurrences | Medium | `artipacked`: artifact/credential packing risk | Review flagged steps for checked-out credentials in uploaded artifacts |
| zizmor | 309 occurrences | Low | `undocumented-permissions`: job `permissions:` blocks lack explanatory comments | Add comments explaining each granted permission |
| zizmor | 313 occurrences | Informational | `anonymous-definition`: jobs without a `name:` | Optional; add job names for readability |
| grype | `alpine:latest`, `node:lts-alpine` | Critical | CVE-2026-63073, CVE-2026-75803 (libssl3/libcrypto3@3.5.7-r0, fix 3.5.8-r0) | Bump base image / rebuild to pick up patched OpenSSL package |
| grype | `alpine:latest`, `node:lts-alpine` | High | CVE-2026-18798, CVE-2026-63076, CVE-2026-14457/14456/63072/54874/63075 (libssl3/libcrypto3) | Same OpenSSL upgrade as above |
| grype | `node:lts-alpine` | High | GHSA-rgw5-rvv9-x895 / GHSA-mh99-v99m-4gvg (`brace-expansion@5.0.7`), GHSA-r292-9mhp-454m (`tar@7.5.19`), GHSA-mwp4-54f8-5fhr (`ip-address@10.2.0`) | Update bundled npm packages to fixed versions |
| grype | all 9 images | Medium (312), Unknown (18), Low (54), Negligible (27) | Assorted OS/library CVEs (bind9-libs, busybox, undici, etc.) | Track via routine base-image refresh; no immediate action required beyond the Critical/High set |
| grant | `alpine:latest`, `ghcr.io/github/gh-aw-firewall/*`, `node:lts-alpine`, `github-mcp-server` | error (policy) | 1246 license policy violations (GPL-2.0-only, LGPL, MPL-2.0, ISC, BlueOak-1.0.0, HPND-sell-variant, etc. — mostly base-OS and transitive npm packages not on the allowlist) | `.grant.yaml` currently declares no `licenses:` allowlist; add an explicit allowed-license policy (or documented exceptions) covering standard OSS licenses used by these pinned images |
| poutine | untracked `.poutine.yml` diff hunk (`agentic_commands.yml:1`) | medium (RGS-005) | Excessive permissions on untrusted trigger reported against a synthetic single-line diff artifact, not a real workflow file | Verify this is a scanner artifact of the diff format, not an actual finding; no workflow source change needed if confirmed benign |
| runner-guard | — | — | No additional findings beyond the poutine RGS-005 line above | — |
| yamllint | 53 files | — | Clean, no findings | — |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

**Compiler summary:**
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

**Actionlint summary:**
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• expression: 2
• shellcheck: 72
```

**Zizmor rule counts (across 53 files):**
```
444 [Medium] secrets-outside-env
313 [Informational] anonymous-definition
309 [Low] undocumented-permissions
52 [High] github-app
33 [Medium] artipacked
25 [Low] adhoc-packages
9 [Informational] template-injection
3 [Low] obfuscation
```

**Grype severity counts (9 images):**
```
34 Critical
172 High
312 Medium
54 Low
27 Negligible
18 Unknown
```

**Grant:**
```
✗ grant failed
strict mode: grant found 1246 license policy finding(s) in container images
```

**Sample grant findings (alpine:latest):**
```
alpine:latest:1:1: error: license policy violation: busybox@1.37.0-r31 (GPL-2.0-only)
alpine:latest:1:1: error: license policy violation: alpine-keys@2.6-r0 (MIT)
alpine:latest:1:1: error: license policy violation: ca-certificates-bundle@20260611-r0 (MPL-2.0, MIT)
alpine:latest:1:1: error: license policy violation: libssl3@3.5.7-r0 (Apache-2.0)
```

**Poutine/runner-guard:**
```
.github/workflows/agentic_commands.yml:1:1: warning: [medium] RGS-005: Excessive Permissions on Untrusted Trigger
```

No token-like or credential-like values were present in the reviewed output.

Control plane context

- Correlation ID: `34933423838-50`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34933423838

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34933423838) · copilot · auto · 93.9 AIC · ⌖ 7.27 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 6:02 AM UTC

Start with the 53 .github/workflows/*.md sources, the shared Pi CLI script template, the two workflows with safe-outputs-app-token references, and .grant.yaml; do not edit generated .lock.yml files. Use the gh aw MCP server's fix and compile entry points, then run the listed compiler and security scans. Done means the generated workflows preserve behavior and the full strict scan passes, or an unsafe finding is documented for human action.

Written by the indexing model from the issue text.